Examkin

Question

Difficulty: MediumVPC Security for Developers

A team is deploying a serverless data ingestion application. An AWS Lambda function needs to read and write data to an Amazon ElastiCache for Redis cluster located in the private subnets of a VPC. The Lambda function also must perform outbound HTTPS requests to an external validation API on the public internet. Which TWO network and security configurations must the developer implement to establish this connectivity? (Select TWO.)

  1. Configure the Lambda function to run in the private subnets of the VPC, and configure a route to a NAT Gateway in a public subnet to route outbound traffic from the private subnets to the internet.Answer
  2. Configure the security group of the ElastiCache cluster to allow inbound TCP traffic on port 6379 from the security group assigned to the Lambda function.Answer
  3. C
    Attach the Lambda function to the public subnets of the VPC to allow direct outbound communication to the external API via an Internet Gateway.
  4. D
    Modify the trust policy of the Lambda execution role to allow the Systems Manager Parameter Store service principal to access VPC resources.
  5. E
    Configure the ElastiCache connection endpoint as a Parameter Store SecureString parameter and configure Parameter Store to automatically rotate the parameter daily.

Answer

To establish the required connectivity, the developer must place the Lambda function in the VPC's private subnets and use a NAT Gateway in a public subnet for public internet access, while also adjusting the ElastiCache security group to allow inbound traffic on port 6379 from the Lambda function's security group.
Configuring the Lambda function inside private subnets with a NAT Gateway in a public subnet allows the function to access both private resources (ElastiCache) and the public internet (external API). Modifying the ElastiCache security group to accept inbound traffic from the Lambda security group is required to allow connection requests.

Step-by-Step Solution

1
Place the Lambda function inside the private subnets of the VPC to grant it network path access to the ElastiCache cluster.
The Lambda function is associated with ENIs in the private subnets, enabling it to reach local VPC resources.
VPC-enabled Lambda functions require association with subnets inside the VPC to interact with private endpoints like ElastiCache.
2
Set up a NAT Gateway in a public subnet of the VPC and update the private subnets' route table to forward 0.0.0.0/0 traffic to the NAT Gateway.
The Lambda function in the private subnets can now establish outbound HTTPS connections to the external validation API.
Lambda functions in private subnets cannot access the public internet directly through an Internet Gateway and must use a NAT Gateway.
3
Modify the ElastiCache security group to allow inbound Redis traffic (TCP 6379) from the security group assigned to the Lambda function.
Network communication on port 6379 is allowed through the stateful firewall rules of both security groups.
Security groups act as firewalls at the instance/resource level, and inbound access must be explicitly allowed for connection requests to succeed.

Key Concept

VPC Security for Lambda and ElastiCache connectivity, including security group rules and private-to-public routing.
Estimated Time:2m 0s
Rate this question

Topics

VPC Security for Developers

More questions from this topic